SHADOW#REACTOR Malware Builds Remcos RAT via Text Files

Securonix research identifies SHADOW#REACTOR, a sophisticated loader framework that avoids disk-based artifacts by retrieving fragmented text payloads, reconstructing and decoding them in memory via a .NET Reactor-protected assembly, and using legitimate Windows binaries (wscript.exe, MSBuild.exe) to deploy the Remcos RAT at scale; the campaign appears indiscriminate, financially motivated, and designed to provide initial access for further criminal activity.